|
smb4K Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA23937
|
|
|
Release Date:
|
2007-01-29
|
|
Last Update:
|
2007-02-06
|
|
Popularity:
|
4,977 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
Privilege escalation
DoS
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Smb4K 0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-0472
CVE-2007-0473
CVE-2007-0474
CVE-2007-0475
|
|
Description:
Kees Cook has reported some vulnerabilities in smb4K, which can be exploited by malicious, local users to kill arbitrary processes, disclose potentially sensitive information, and gain escalated privileges.
1) The "writeFile()" function uses the insecure "mktemp()" function, which can lead to a race condition. This can be exploited to add additional lines to the sudoers file.
2) The "writeFile()" function stores the contents of the sudoers file in a world readable file. This can be exploited to gain knowledge of potentially sensitive information.
3) A design issue within the "smb4k_kill" utility can be exploited to kill any process on an affected system.
4) All smb4k utilities contain boundary errors within the handling of passed arguments. This can be exploited to execute arbitrary code with escalated privileges.
The vulnerabilities are reported in versions prior to 0.8.0.
Solution:
Update to version 0.8.0.
Provided and/or discovered by:
Kees Cook
Changelog:
2007-02-06: Added CVE reference.
Original Advisory:
http://developer.berlios.de/bugs/?fun...lbug&bug_id=9630&group_id=769
http://developer.berlios.de/bugs/?fun...lbug&bug_id=9631&group_id=769
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
